M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-shell/src/agent/mvp_agent/tests.rs

@@ -648,8 +648,6 @@ async fn file_toolset_override_e2e_to_finalized_toolset() {
         web_search_config: kigi_tools::implementations::web_search::WebSearchConfig::default(),
         web_fetch_config: Default::default(),
         lsp: None,
-        image_gen_config: kigi_tools::implementations::grok_build::image_gen::ImageGenConfig::default(),
-        video_gen_config: kigi_tools::implementations::grok_build::video_gen::VideoGenConfig::default(),
         app_builder_deployer_config: kigi_tools::implementations::grok_build::deploy_app::AppBuilderDeployerConfig::default(),
         api_key_provider: None,
         attribution_callback: None,
@@ -744,7 +742,6 @@ fn make_test_handle(
         permission_handle: kigi_workspace::permission::PermissionHandle::allow_all(),
         attribution_callback: None,
         agent_name: "grok-build".to_string(),
-        managed_mcp_proxy_base_url: String::new(),
         session_default_agent_profile: None,
         allowed_subagent_types: None,
         hook_registry: None,
@@ -1136,38 +1133,6 @@ fn test_sessionless_request_requires_session_id() {
         "cwd-only requests with no sessionId must return SessionRequired"
     );
 }
-#[tokio::test(flavor = "current_thread")]
-async fn ext_method_routes_auth_cleared_and_refreshes_resident_sessions() {
-    let local = tokio::task::LocalSet::new();
-    local
-        .run_until(async {
-            let agent = build_agent_with_auth(crate::auth::KimiAuth {
-                key: "eligible".into(),
-                auth_mode: crate::auth::AuthMode::OAuth,
-                ..crate::auth::KimiAuth::test_default()
-            });
-            use acp::Agent as _;
-            agent.managed_mcp_cache.lock().await.enable_gateway_tools();
-            let sid = acp::SessionId::new("sess-auth-cleared");
-            let (handle, _tx, mut cmd_rx) = make_live_session_handle(&sid, None);
-            agent.sessions.borrow_mut().insert(sid, handle);
-            let params = serde_json::json!({});
-            agent
-                .ext_method(acp::ExtRequest::new(
-                    "x.ai/internal/auth_cleared",
-                    std::sync::Arc::from(serde_json::value::to_raw_value(&params).unwrap()),
-                ))
-                .await
-                .expect("auth_cleared must route through session-admin");
-            let cmd = tokio::time::timeout(std::time::Duration::from_secs(1), cmd_rx.recv())
-                .await
-                .expect("refresh command should be sent")
-                .expect("channel should stay open until command is received");
-            assert!(matches!(cmd, SessionCommand::RefreshMcpSearchIndex));
-            assert!(!agent.managed_mcp_cache.lock().await.gateway_tools_active);
-        })
-        .await;
-}
 /// Build a minimal MvpAgent suitable for testing extension methods.
 fn build_minimal_agent_for_tests() -> MvpAgent {
     use crate::agent::config::Config as AgentConfig;
@@ -1860,7 +1825,7 @@ async fn auth_type_session_based_no_current_returns_session_token() {
 /// BYOK guard. Users with `xai.api_key` must continue to report `ApiKey`
 /// regardless of live-token state -- BYOK sessions have nothing to refresh,
 /// and reporting `SessionToken` would route through cli-chat-proxy paths
-/// (image_gen / video_gen base_url) that don't apply to BYOK keys.
+/// that don't apply to BYOK keys.
 #[tokio::test(flavor = "current_thread")]
 async fn auth_type_xai_api_key_no_current_returns_api_key() {
     let agent = build_minimal_agent_for_tests();
@@ -1952,26 +1917,6 @@ async fn cached_token_fallthrough_falls_to_grok_com_without_credentials() {
         "no API-key creds and no kill switch -> interactive grok.com login",
     );
 }
-/// The imagine tier gate fails **open**: with no resolved auth we can't confirm
-/// a restricted personal tier, so the tools stay advertised and un-flagged (the
-/// server 429 remains the authoritative backstop). Guards against accidentally
-/// disabling a paid feature when tier info hasn't loaded.
-#[tokio::test(flavor = "current_thread")]
-async fn prepare_image_gen_config_fails_open_without_auth() {
-    use kigi_tools::implementations::grok_build::image_gen::ImageGenConfig;
-    let agent = build_minimal_agent_for_tests();
-    agent.sampling_config.borrow_mut().api_key = Some("test-key".to_string());
-    let ImageGenConfig::Enabled {
-        tier_restricted, ..
-    } = agent.prepare_image_gen_config()
-    else {
-        panic!("expected Enabled");
-    };
-    assert!(
-        !tier_restricted,
-        "no resolved auth ⇒ fail open (tools not tier-restricted)"
-    );
-}
 /// `parse_session_kind` routes `session/load` to the gateway Chat path vs. the
 /// disk-backed Build path. Anything but an explicit `kind: "chat"` is Build.
 #[test]
@@ -2107,7 +2052,6 @@ fn chat_session_spawn_options_matches_thin_profile() {
     assert!(!opts.client_fs_read);
     assert!(!opts.client_fs_write);
     assert!(opts.chat_history.is_empty());
-    assert!(opts.managed_mcp_expires_at.is_none());
     assert!(!opts.session_auto_mode);
     assert!(
         opts.persistence.is_noop(),